nbd-fix-null-pointer-in-flush_workqueue.patch
blk-mq-plug-request-for-shared-sbitmap.patch
blk-mq-swap-two-calls-in-blk_mq_exit_queue.patch
+usb-dwc3-omap-improve-extcon-initialization.patch
+usb-dwc3-pci-enable-usb2-gadget-lpm-disable-for-intel-merrifield.patch
+usb-xhci-increase-timeout-for-hc-halt.patch
+usb-dwc2-fix-gadget-dma-unmap-direction.patch
+usb-core-hub-fix-race-condition-about-trsmrcy-of-resume.patch
+usb-dwc3-gadget-enable-suspend-events.patch
+usb-dwc3-gadget-return-success-always-for-kick-transfer-in-ep-queue.patch
+usb-typec-ucsi-retrieve-all-the-pdos-instead-of-just-the-first-4.patch
+usb-typec-ucsi-put-fwnode-in-any-case-during-probe.patch
--- /dev/null
+From 975f94c7d6c306b833628baa9aec3f79db1eb3a1 Mon Sep 17 00:00:00 2001
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Date: Wed, 12 May 2021 10:07:38 +0800
+Subject: usb: core: hub: fix race condition about TRSMRCY of resume
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+commit 975f94c7d6c306b833628baa9aec3f79db1eb3a1 upstream.
+
+This may happen if the port becomes resume status exactly
+when usb_port_resume() gets port status, it still need provide
+a TRSMCRY time before access the device.
+
+CC: <stable@vger.kernel.org>
+Reported-by: Tianping Fang <tianping.fang@mediatek.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Link: https://lore.kernel.org/r/20210512020738.52961-1-chunfeng.yun@mediatek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/hub.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -3593,9 +3593,6 @@ int usb_port_resume(struct usb_device *u
+ * sequence.
+ */
+ status = hub_port_status(hub, port1, &portstatus, &portchange);
+-
+- /* TRSMRCY = 10 msec */
+- msleep(10);
+ }
+
+ SuspendCleared:
+@@ -3610,6 +3607,9 @@ int usb_port_resume(struct usb_device *u
+ usb_clear_port_feature(hub->hdev, port1,
+ USB_PORT_FEAT_C_SUSPEND);
+ }
++
++ /* TRSMRCY = 10 msec */
++ msleep(10);
+ }
+
+ if (udev->persist_enabled)
--- /dev/null
+From 75a41ce46bae6cbe7d3bb2584eb844291d642874 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 6 May 2021 12:22:00 +0100
+Subject: usb: dwc2: Fix gadget DMA unmap direction
+
+From: Phil Elwell <phil@raspberrypi.com>
+
+commit 75a41ce46bae6cbe7d3bb2584eb844291d642874 upstream.
+
+The dwc2 gadget support maps and unmaps DMA buffers as necessary. When
+mapping and unmapping it uses the direction of the endpoint to select
+the direction of the DMA transfer, but this fails for Control OUT
+transfers because the unmap occurs after the endpoint direction has
+been reversed for the status phase.
+
+A possible solution would be to unmap the buffer before the direction
+is changed, but a safer, less invasive fix is to remember the buffer
+direction independently of the endpoint direction.
+
+Fixes: fe0b94abcdf6 ("usb: dwc2: gadget: manage ep0 state in software")
+Acked-by: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+Link: https://lore.kernel.org/r/20210506112200.2893922-1-phil@raspberrypi.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/core.h | 2 ++
+ drivers/usb/dwc2/gadget.c | 3 ++-
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc2/core.h
++++ b/drivers/usb/dwc2/core.h
+@@ -112,6 +112,7 @@ struct dwc2_hsotg_req;
+ * @debugfs: File entry for debugfs file for this endpoint.
+ * @dir_in: Set to true if this endpoint is of the IN direction, which
+ * means that it is sending data to the Host.
++ * @map_dir: Set to the value of dir_in when the DMA buffer is mapped.
+ * @index: The index for the endpoint registers.
+ * @mc: Multi Count - number of transactions per microframe
+ * @interval: Interval for periodic endpoints, in frames or microframes.
+@@ -161,6 +162,7 @@ struct dwc2_hsotg_ep {
+ unsigned short fifo_index;
+
+ unsigned char dir_in;
++ unsigned char map_dir;
+ unsigned char index;
+ unsigned char mc;
+ u16 interval;
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -422,7 +422,7 @@ static void dwc2_hsotg_unmap_dma(struct
+ {
+ struct usb_request *req = &hs_req->req;
+
+- usb_gadget_unmap_request(&hsotg->gadget, req, hs_ep->dir_in);
++ usb_gadget_unmap_request(&hsotg->gadget, req, hs_ep->map_dir);
+ }
+
+ /*
+@@ -1242,6 +1242,7 @@ static int dwc2_hsotg_map_dma(struct dwc
+ {
+ int ret;
+
++ hs_ep->map_dir = hs_ep->dir_in;
+ ret = usb_gadget_map_request(&hsotg->gadget, req, hs_ep->dir_in);
+ if (ret)
+ goto dma_error;
--- /dev/null
+From d1d90dd27254c44d087ad3f8b5b3e4fff0571f45 Mon Sep 17 00:00:00 2001
+From: Jack Pham <jackp@codeaurora.org>
+Date: Wed, 28 Apr 2021 02:01:10 -0700
+Subject: usb: dwc3: gadget: Enable suspend events
+
+From: Jack Pham <jackp@codeaurora.org>
+
+commit d1d90dd27254c44d087ad3f8b5b3e4fff0571f45 upstream.
+
+commit 72704f876f50 ("dwc3: gadget: Implement the suspend entry event
+handler") introduced (nearly 5 years ago!) an interrupt handler for
+U3/L1-L2 suspend events. The problem is that these events aren't
+currently enabled in the DEVTEN register so the handler is never
+even invoked. Fix this simply by enabling the corresponding bit
+in dwc3_gadget_enable_irq() using the same revision check as found
+in the handler.
+
+Fixes: 72704f876f50 ("dwc3: gadget: Implement the suspend entry event handler")
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Jack Pham <jackp@codeaurora.org>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210428090111.3370-1-jackp@codeaurora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2206,6 +2206,10 @@ static void dwc3_gadget_enable_irq(struc
+ if (DWC3_VER_IS_PRIOR(DWC3, 250A))
+ reg |= DWC3_DEVTEN_ULSTCNGEN;
+
++ /* On 2.30a and above this bit enables U3/L2-L1 Suspend Events */
++ if (!DWC3_VER_IS_PRIOR(DWC3, 230A))
++ reg |= DWC3_DEVTEN_EOPFEN;
++
+ dwc3_writel(dwc->regs, DWC3_DEVTEN, reg);
+ }
+
--- /dev/null
+From 18ffa988dbae69cc6e9949cddd9606f6fe533894 Mon Sep 17 00:00:00 2001
+From: Wesley Cheng <wcheng@codeaurora.org>
+Date: Fri, 7 May 2021 10:55:19 -0700
+Subject: usb: dwc3: gadget: Return success always for kick transfer in ep queue
+
+From: Wesley Cheng <wcheng@codeaurora.org>
+
+commit 18ffa988dbae69cc6e9949cddd9606f6fe533894 upstream.
+
+If an error is received when issuing a start or update transfer
+command, the error handler will stop all active requests (including
+the current USB request), and call dwc3_gadget_giveback() to notify
+function drivers of the requests which have been stopped. Avoid
+returning an error for kick transfer during EP queue, to remove
+duplicate cleanup operations on the request being queued.
+
+Fixes: 8d99087c2db8 ("usb: dwc3: gadget: Properly handle failed kick_transfer")
+cc: stable@vger.kernel.org
+Signed-off-by: Wesley Cheng <wcheng@codeaurora.org>
+Link: https://lore.kernel.org/r/1620410119-24971-1-git-send-email-wcheng@codeaurora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1676,7 +1676,9 @@ static int __dwc3_gadget_ep_queue(struct
+ }
+ }
+
+- return __dwc3_gadget_kick_transfer(dep);
++ __dwc3_gadget_kick_transfer(dep);
++
++ return 0;
+ }
+
+ static int dwc3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request,
--- /dev/null
+From e17b02d4970913233d543c79c9c66e72cac05bdd Mon Sep 17 00:00:00 2001
+From: Marcel Hamer <marcel@solidxs.se>
+Date: Tue, 27 Apr 2021 14:21:18 +0200
+Subject: usb: dwc3: omap: improve extcon initialization
+
+From: Marcel Hamer <marcel@solidxs.se>
+
+commit e17b02d4970913233d543c79c9c66e72cac05bdd upstream.
+
+When extcon is used in combination with dwc3, it is assumed that the dwc3
+registers are untouched and as such are only configured if VBUS is valid
+or ID is tied to ground.
+
+In case VBUS is not valid or ID is floating, the registers are not
+configured as such during driver initialization, causing a wrong
+default state during boot.
+
+If the registers are not in a default state, because they are for
+instance touched by a boot loader, this can cause for a kernel error.
+
+Signed-off-by: Marcel Hamer <marcel@solidxs.se>
+Link: https://lore.kernel.org/r/20210427122118.1948340-1-marcel@solidxs.se
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-omap.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/usb/dwc3/dwc3-omap.c
++++ b/drivers/usb/dwc3/dwc3-omap.c
+@@ -437,8 +437,13 @@ static int dwc3_omap_extcon_register(str
+
+ if (extcon_get_state(edev, EXTCON_USB) == true)
+ dwc3_omap_set_mailbox(omap, OMAP_DWC3_VBUS_VALID);
++ else
++ dwc3_omap_set_mailbox(omap, OMAP_DWC3_VBUS_OFF);
++
+ if (extcon_get_state(edev, EXTCON_USB_HOST) == true)
+ dwc3_omap_set_mailbox(omap, OMAP_DWC3_ID_GROUND);
++ else
++ dwc3_omap_set_mailbox(omap, OMAP_DWC3_ID_FLOAT);
+
+ omap->edev = edev;
+ }
--- /dev/null
+From 04357fafea9c7ed34525eb9680c760245c3bb958 Mon Sep 17 00:00:00 2001
+From: Ferry Toth <ftoth@exalondelft.nl>
+Date: Sun, 25 Apr 2021 17:09:47 +0200
+Subject: usb: dwc3: pci: Enable usb2-gadget-lpm-disable for Intel Merrifield
+
+From: Ferry Toth <ftoth@exalondelft.nl>
+
+commit 04357fafea9c7ed34525eb9680c760245c3bb958 upstream.
+
+On Intel Merrifield LPM is causing host to reset port after a timeout.
+By disabling LPM entirely this is prevented.
+
+Fixes: 066c09593454 ("usb: dwc3: pci: Enable extcon driver for Intel Merrifield")
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Ferry Toth <ftoth@exalondelft.nl>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210425150947.5862-1-ftoth@exalondelft.nl
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -120,6 +120,7 @@ static const struct property_entry dwc3_
+ PROPERTY_ENTRY_STRING("linux,extcon-name", "mrfld_bcove_pwrsrc"),
+ PROPERTY_ENTRY_BOOL("snps,dis_u3_susphy_quirk"),
+ PROPERTY_ENTRY_BOOL("snps,dis_u2_susphy_quirk"),
++ PROPERTY_ENTRY_BOOL("snps,usb2-gadget-lpm-disable"),
+ PROPERTY_ENTRY_BOOL("linux,sysdev_is_parent"),
+ {}
+ };
--- /dev/null
+From b9a0866a5bdf6a4643a52872ada6be6184c6f4f2 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andy.shevchenko@gmail.com>
+Date: Wed, 5 May 2021 01:23:37 +0300
+Subject: usb: typec: ucsi: Put fwnode in any case during ->probe()
+
+From: Andy Shevchenko <andy.shevchenko@gmail.com>
+
+commit b9a0866a5bdf6a4643a52872ada6be6184c6f4f2 upstream.
+
+device_for_each_child_node() bumps a reference counting of a returned variable.
+We have to balance it whenever we return to the caller.
+
+Fixes: c1b0bc2dabfa ("usb: typec: Add support for UCSI interface")
+Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/20210504222337.3151726-1-andy.shevchenko@gmail.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/ucsi/ucsi.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -995,6 +995,7 @@ static const struct typec_operations ucs
+ .pr_set = ucsi_pr_swap
+ };
+
++/* Caller must call fwnode_handle_put() after use */
+ static struct fwnode_handle *ucsi_find_fwnode(struct ucsi_connector *con)
+ {
+ struct fwnode_handle *fwnode;
+@@ -1028,7 +1029,7 @@ static int ucsi_register_port(struct ucs
+ command |= UCSI_CONNECTOR_NUMBER(con->num);
+ ret = ucsi_send_command(ucsi, command, &con->cap, sizeof(con->cap));
+ if (ret < 0)
+- goto out;
++ goto out_unlock;
+
+ if (con->cap.op_mode & UCSI_CONCAP_OPMODE_DRP)
+ cap->data = TYPEC_PORT_DRD;
+@@ -1124,6 +1125,8 @@ static int ucsi_register_port(struct ucs
+ trace_ucsi_register_port(con->num, &con->status);
+
+ out:
++ fwnode_handle_put(cap->fwnode);
++out_unlock:
+ mutex_unlock(&con->lock);
+ return ret;
+ }
--- /dev/null
+From 1f4642b72be79757f050924a9b9673b6a02034bc Mon Sep 17 00:00:00 2001
+From: Jack Pham <jackp@codeaurora.org>
+Date: Mon, 3 May 2021 00:46:11 -0700
+Subject: usb: typec: ucsi: Retrieve all the PDOs instead of just the first 4
+
+From: Jack Pham <jackp@codeaurora.org>
+
+commit 1f4642b72be79757f050924a9b9673b6a02034bc upstream.
+
+commit 4dbc6a4ef06d ("usb: typec: ucsi: save power data objects
+in PD mode") introduced retrieval of the PDOs when connected to a
+PD-capable source. But only the first 4 PDOs are received since
+that is the maximum number that can be fetched at a time given the
+MESSAGE_IN length limitation (16 bytes). However, as per the PD spec
+a connected source may advertise up to a maximum of 7 PDOs.
+
+If such a source is connected it's possible the PPM could have
+negotiated a power contract with one of the PDOs at index greater
+than 4, and would be reflected in the request data object's (RDO)
+object position field. This would result in an out-of-bounds access
+when the rdo_index() is used to index into the src_pdos array in
+ucsi_psy_get_voltage_now().
+
+With the help of the UBSAN -fsanitize=array-bounds checker enabled
+this exact issue is revealed when connecting to a PD source adapter
+that advertise 5 PDOs and the PPM enters a contract having selected
+the 5th one.
+
+[ 151.545106][ T70] Unexpected kernel BRK exception at EL1
+[ 151.545112][ T70] Internal error: BRK handler: f2005512 [#1] PREEMPT SMP
+...
+[ 151.545499][ T70] pc : ucsi_psy_get_prop+0x208/0x20c
+[ 151.545507][ T70] lr : power_supply_show_property+0xc0/0x328
+...
+[ 151.545542][ T70] Call trace:
+[ 151.545544][ T70] ucsi_psy_get_prop+0x208/0x20c
+[ 151.545546][ T70] power_supply_uevent+0x1a4/0x2f0
+[ 151.545550][ T70] dev_uevent+0x200/0x384
+[ 151.545555][ T70] kobject_uevent_env+0x1d4/0x7e8
+[ 151.545557][ T70] power_supply_changed_work+0x174/0x31c
+[ 151.545562][ T70] process_one_work+0x244/0x6f0
+[ 151.545564][ T70] worker_thread+0x3e0/0xa64
+
+We can resolve this by instead retrieving and storing up to the
+maximum of 7 PDOs in the con->src_pdos array. This would involve
+two calls to the GET_PDOS command.
+
+Fixes: 992a60ed0d5e ("usb: typec: ucsi: register with power_supply class")
+Fixes: 4dbc6a4ef06d ("usb: typec: ucsi: save power data objects in PD mode")
+Cc: stable@vger.kernel.org
+Reported-and-tested-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Jack Pham <jackp@codeaurora.org>
+Link: https://lore.kernel.org/r/20210503074611.30973-1-jackp@codeaurora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/ucsi/ucsi.c | 41 ++++++++++++++++++++++++++++++++---------
+ drivers/usb/typec/ucsi/ucsi.h | 6 ++++--
+ 2 files changed, 36 insertions(+), 11 deletions(-)
+
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -495,7 +495,8 @@ static void ucsi_unregister_altmodes(str
+ }
+ }
+
+-static void ucsi_get_pdos(struct ucsi_connector *con, int is_partner)
++static int ucsi_get_pdos(struct ucsi_connector *con, int is_partner,
++ u32 *pdos, int offset, int num_pdos)
+ {
+ struct ucsi *ucsi = con->ucsi;
+ u64 command;
+@@ -503,17 +504,39 @@ static void ucsi_get_pdos(struct ucsi_co
+
+ command = UCSI_COMMAND(UCSI_GET_PDOS) | UCSI_CONNECTOR_NUMBER(con->num);
+ command |= UCSI_GET_PDOS_PARTNER_PDO(is_partner);
+- command |= UCSI_GET_PDOS_NUM_PDOS(UCSI_MAX_PDOS - 1);
++ command |= UCSI_GET_PDOS_PDO_OFFSET(offset);
++ command |= UCSI_GET_PDOS_NUM_PDOS(num_pdos - 1);
+ command |= UCSI_GET_PDOS_SRC_PDOS;
+- ret = ucsi_send_command(ucsi, command, con->src_pdos,
+- sizeof(con->src_pdos));
+- if (ret < 0) {
++ ret = ucsi_send_command(ucsi, command, pdos + offset,
++ num_pdos * sizeof(u32));
++ if (ret < 0)
+ dev_err(ucsi->dev, "UCSI_GET_PDOS failed (%d)\n", ret);
++ if (ret == 0 && offset == 0)
++ dev_warn(ucsi->dev, "UCSI_GET_PDOS returned 0 bytes\n");
++
++ return ret;
++}
++
++static void ucsi_get_src_pdos(struct ucsi_connector *con, int is_partner)
++{
++ int ret;
++
++ /* UCSI max payload means only getting at most 4 PDOs at a time */
++ ret = ucsi_get_pdos(con, 1, con->src_pdos, 0, UCSI_MAX_PDOS);
++ if (ret < 0)
+ return;
+- }
++
+ con->num_pdos = ret / sizeof(u32); /* number of bytes to 32-bit PDOs */
+- if (ret == 0)
+- dev_warn(ucsi->dev, "UCSI_GET_PDOS returned 0 bytes\n");
++ if (con->num_pdos < UCSI_MAX_PDOS)
++ return;
++
++ /* get the remaining PDOs, if any */
++ ret = ucsi_get_pdos(con, 1, con->src_pdos, UCSI_MAX_PDOS,
++ PDO_MAX_OBJECTS - UCSI_MAX_PDOS);
++ if (ret < 0)
++ return;
++
++ con->num_pdos += ret / sizeof(u32);
+ }
+
+ static void ucsi_pwr_opmode_change(struct ucsi_connector *con)
+@@ -522,7 +545,7 @@ static void ucsi_pwr_opmode_change(struc
+ case UCSI_CONSTAT_PWR_OPMODE_PD:
+ con->rdo = con->status.request_data_obj;
+ typec_set_pwr_opmode(con->port, TYPEC_PWR_MODE_PD);
+- ucsi_get_pdos(con, 1);
++ ucsi_get_src_pdos(con, 1);
+ break;
+ case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5:
+ con->rdo = 0;
+--- a/drivers/usb/typec/ucsi/ucsi.h
++++ b/drivers/usb/typec/ucsi/ucsi.h
+@@ -8,6 +8,7 @@
+ #include <linux/power_supply.h>
+ #include <linux/types.h>
+ #include <linux/usb/typec.h>
++#include <linux/usb/pd.h>
+
+ /* -------------------------------------------------------------------------- */
+
+@@ -133,7 +134,9 @@ void ucsi_connector_change(struct ucsi *
+
+ /* GET_PDOS command bits */
+ #define UCSI_GET_PDOS_PARTNER_PDO(_r_) ((u64)(_r_) << 23)
++#define UCSI_GET_PDOS_PDO_OFFSET(_r_) ((u64)(_r_) << 24)
+ #define UCSI_GET_PDOS_NUM_PDOS(_r_) ((u64)(_r_) << 32)
++#define UCSI_MAX_PDOS (4)
+ #define UCSI_GET_PDOS_SRC_PDOS ((u64)1 << 34)
+
+ /* -------------------------------------------------------------------------- */
+@@ -301,7 +304,6 @@ struct ucsi {
+
+ #define UCSI_MAX_SVID 5
+ #define UCSI_MAX_ALTMODES (UCSI_MAX_SVID * 6)
+-#define UCSI_MAX_PDOS (4)
+
+ #define UCSI_TYPEC_VSAFE5V 5000
+ #define UCSI_TYPEC_1_5_CURRENT 1500
+@@ -329,7 +331,7 @@ struct ucsi_connector {
+ struct power_supply *psy;
+ struct power_supply_desc psy_desc;
+ u32 rdo;
+- u32 src_pdos[UCSI_MAX_PDOS];
++ u32 src_pdos[PDO_MAX_OBJECTS];
+ int num_pdos;
+ };
+
--- /dev/null
+From ca09b1bea63ab83f4cca3a2ae8bc4f597ec28851 Mon Sep 17 00:00:00 2001
+From: Maximilian Luz <luzmaximilian@gmail.com>
+Date: Wed, 12 May 2021 11:08:15 +0300
+Subject: usb: xhci: Increase timeout for HC halt
+
+From: Maximilian Luz <luzmaximilian@gmail.com>
+
+commit ca09b1bea63ab83f4cca3a2ae8bc4f597ec28851 upstream.
+
+On some devices (specifically the SC8180x based Surface Pro X with
+QCOM04A6) HC halt / xhci_halt() times out during boot. Manually binding
+the xhci-hcd driver at some point later does not exhibit this behavior.
+To work around this, double XHCI_MAX_HALT_USEC, which also resolves this
+issue.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20210512080816.866037-5-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-ext-caps.h | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-ext-caps.h
++++ b/drivers/usb/host/xhci-ext-caps.h
+@@ -7,8 +7,9 @@
+ * Author: Sarah Sharp
+ * Some code borrowed from the Linux EHCI driver.
+ */
+-/* Up to 16 ms to halt an HC */
+-#define XHCI_MAX_HALT_USEC (16*1000)
++
++/* HC should halt within 16 ms, but use 32 ms as some hosts take longer */
++#define XHCI_MAX_HALT_USEC (32 * 1000)
+ /* HC not running - set to 1 when run/stop bit is cleared. */
+ #define XHCI_STS_HALT (1<<0)
+